secp256k1 (the signature scheme used by Bitcoin) has the interesting property that you can add two public keys to get a combined key that requires both private keys to produce signatures for.

Is there another, more widely used public key cryptography scheme with the same property?


1 Answer 1


Yes. Discrete-log based cryptosystems (e.g., El Gamal) have a similar property. It's "multiply", not "add", but that's just because that's the group operation for discrete-log based cryptosystems.

More generally, I suggest you look at threshold cryptography. Threshold public-key cryptosystems are a class of systems that can achieve the sort of thing you mention.

  • $\begingroup$ Do you know of any threshold signature schemes that are not discrete-log based but have better-than-generic performance for combining already-existing verification keys? $\;$ $\endgroup$
    – user991
    Apr 26, 2015 at 7:00
  • $\begingroup$ @RickyDemer, I don't know. I guess that's a different question. If you're suggesting that might be what the OP wanted, if so, he needs to specify his requirements or goals in the question. Right now the question only asks for "another, more widely used" scheme. I can only answer the question that was asked.... $\endgroup$
    – D.W.
    Apr 26, 2015 at 7:03
  • $\begingroup$ Your upper paragraph does squarely address the question. $\:$ I was just wondering if your lower paragraph was more related to the question than it seemed. $\;\;\;\;$ $\endgroup$
    – user991
    Apr 26, 2015 at 7:08
  • $\begingroup$ @RickyDemer My feeling is that the first paragraph does answer the question, but that the text should be clarified and further explained why and how it answers the question. $\endgroup$
    – Maarten Bodewes
    Apr 26, 2015 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.